Practical Secrecy-Preserving, Verifiably Correct and Trustworthy Auctions David C. Parkes ∗ Harvard University SEAS, Cambridge, MA Michael O. Rabin Harvard University SEAS, Cambridge, MA Stuart M. Shieber Harvard University SEAS, Cambridge, MA Christopher Thorpe Harvard University SEAS, Cambridge, MA Abstract We present a practical protocol based on homomorphic cryptography for conducting provably fair sealed-bid auctions. The system preserves the secrecy of the bids, even after the announcement of auction results, while also providing for public verifiability of the cor- rectness and trustworthiness of the outcome. No party, including the auctioneer, receives any information about bids before the auction closes, and no bidder is able to change or repudiate any bid. The system is illustrated through application to first-price, uniform-price and second-price auctions, including multi-item auctions. Empirical results based on an analysis of a prototype demonstrate the practicality of our protocol for real-world applica- tions. Key words: Auctions, auction theory, cryptographic auctions, cryptography, e-commerce, electronic transactions, homomorphic cryptography, security. ∗ Corresponding author. Address: 33 Oxford St., Cambridge MA 02138, USA. Tel.: +1- 617-384-8130. Fax: +1-617-495-9837. Email addresses: [email protected] (David C. Parkes), [email protected] (Michael O. Rabin), [email protected] (Stuart M. Shieber), [email protected] (Christopher Thorpe). Preprint submitted to Elsevier 16 April 2008 1 Introduction In recent years, auctions and electronic marketplaces have been used to facilitate trillions of dollars in trade in the world economy [25]. Auctions, in particular, are often adopted to promote the ideal of competitive pricing and economic ef- ficiency [44,8]. Previously used for rare goods, or for time-sensitive goods (e.g., flowers and fish), auctions can now be harnessed for all kinds of commercial trans- actions [48]. Auctions see especially wide use for the procurement of goods and services by firms and governments [23,31,77]. We also note that more and more auctions of all kinds are electronic, and operate over the Internet, which reduces the cost of participation and enables worldwide competition. Individual procurement events in the private sector, for instance, the procurement of truckload services by Procter and Gamble, approach US $1 billion in transaction value [69]. To give a sense of the scale of procurement in the public sector, Asker and Cantillon [5] estimate public procurement in the European Union at about 16% of its GDP; by this estimate public procurement comprised $2 trillion of trade in 2006 [78]. Governments worldwide also use auctions to allocate property rights, such as auctions for wireless spectrum [45] (with worldwide proceeds exceeding US $100 billion by the end of 2001 [48]). In a typical week in February, 2006, the U.S. treasury sells more than US $25 billion in three-month treasury bills through a sealed-bid auction. 1 Sponsored search auctions drive over $1 billion in revenue to Google each quarter [39], and the eBay marketplace reported a record US $44.3 billion volume in the 2005 calendar year, representing a 30% increase over 2004. Why are auctions so popular? Trepte [77] emphasizes the role auctions play in promoting competition. Competition, in turn, provides incentives for bidders to act as ‘honest brokers’ of information, so that in the context of procurement the winner is the most technically efficient firm. Yet, auctions are only effective in promoting competition if they are trustworthy, with all bids treated fairly and equally and all bids are seen to be treated in this way [77]. In discussing the role of regulation in the context of procurement auctions, Trepte emphasizes the importance of being able to commit to an objective process, so that “... the buyer binds himself in such a way that all bidders know that he will not, indeed cannot, change his procedures after observing the bids, even though it may be in his interest to do so.” Schelling [71] had already noted “... it is a paradox that the power to constrain an adversary may depend on the power to bind oneself.” In the context of auctions the point is a simple one: the firm engaged in procurement would like to commit not to advantage one firm over another to promote fair competition. 1 Generally sold in uniform-price auctions. See http://www.publicdebt.treas.gov 2 1.1 The Problem of Corruption Auctions are not immune to corruption and this commitment to a correct process can be hard to achieve. By corruption, we mean the auctioneer breaking the rules of the auction in favor of some bidder(s), typically in exchange for bribes [40]. The possibility of corruption exists in an auction whenever the auctioneer is not the owner of the goods for sale in the auction, or the owner of the firm that is seeking to procure goods [40]. For instance, there is a possible conflict of interest when the auction is operated by an individual within a large firm, or by a public servant within a government organization [38]. As evidence of the extent of concern about corruption in competitive processes, the main goal of governments and international bodies such as the World Bank, in reg- ulating public procurement auctions, is to “curb the discretion” of the buyer [77]. The World Bank recently estimated the volume of bribes exchanging hands for pub- lic sector procurement alone to be roughly US$200 billion per year, with the annual volume of procurement projects ‘tainted’ by bribes close to US$1.5 trillion [75], and has made the fight against corruption a top priority [21]. When price is the only factor in determining the winner of an auction, then many authors argue that using an open and verifiable, sealed-bid auction should help to prevent corruption [77,66,41]. In a sealed bid auction, bids are committed during the bidding process and then opened simultaneously by the auctioneer and the rules correctly followed to determine the winner (and price). However, it seems difficult in practice to ensure a fully trustworthy sealed-bid auction. The kinds of manipula- tions that are possible in a first-price sealed-bid auction include the following: • The auctioneer allows a favored bidder to improve on the bid of the winning bidder (possibly the same favored bidder) by revealing information about other submitted bids before the auction closes [41], or by inserting a bid for the favored bidder after reviewing the submitted bids. This allows the favored bidder to win at the best possible price. • A favored winning or second-place bidder can be invited to change a bid after the auction has closed in order to obtain a better price or win the auction, respec- tively [47]. • Bribes can can be received before bids are made, in exchange for a promise to modify the bidder’s bid to the bidder’s advantage should that bidder be the winner [34]. Each of these manipulations relies on the ability to circumvent the intended sealed- bid auction process. The first method relies on learning information before the close of the auction, or being able to insert or modify a bid after some bidders have already bid. The second and third methods rely on being able to change, or cancel, bids after the close of the auction. 3 More than ethically troubling, corruption is undesirable because it can lead to both an efficiency loss (e.g., with the wrong supplier winning a contract) and also a distributional effect (e.g., with the government paying too much for a con- tract) [3,21,34,47,18,14,15]. Corruption is a widespread, real-world problem, as illustrated by the following examples: • A 1988 U.S. investigation, Operation Ill Wind, into defense procurement fraud resulted in the conviction of 46 individuals and 6 defense corporations, with fines and penalties totaling US$190 million [14]. • Mafia families in New York City would sometimes pay bribes for an “under- taker’s look” at the bids of other bidders before making their own bids when bidding for waste-disposal contracts [34]. • In 1996, Siemens was barred from bidding in public procurement auctions in Singapore for five years because they bribed the chief executive of Singapore’s public utility corporation in exchange for information about rival bids [40]. • As many as 40–50 “information brokers” (buying information from oil compa- nies and selling to suppliers) may be actively working at any given point of time in the North Sea oil industry, with corruption and bid rigging affecting upwards of 15% of contracts (an economic value of GB£1.75 billion per year in 1995) [2]. Driving home the difficulty of implementing truly sealed-bid auction processes, In- graham [30] provides a remarkable account of corruption in New York City School Construction Authority (SCA) auctions, an approximately US$1 billion per year market. Two SCA employees and eleven individuals within seven contracting firms were implicated in the corruption. A dishonest contractor would submit a bid well below the projected price of the contract, and during the public announcements of the bids, the auctioneer would save the favored bid until the other bids were opened and announced. Knowing the current low bid, the dishonest auctioneer would then read aloud a false bid just below the current low bid instead of the artificial bid actually submitted. The bid form would subsequently be corrected with correction fluid. Second-price auctions are robust against all three of these manipulations [47]. In a second-price (Vickrey) auction the good is sold to the highest bidder for the second highest bid price [79] (respectively, bought from the lowest bidder for the second lowest bid price in a reverse auction such as a procurement auction).